Automatic correction of security downgraders

ABSTRACT

Methods and systems for automatic correction of security downgraders. For one or more flows having one or more candidate downgraders, it is determined whether each candidate downgrader protects against all vulnerabilities associated with the candidate downgrader&#39;s respective flow. Candidate downgraders that do not protect against all of the associated vulnerabilities are transformed, such that the transformed downgraders do protect against all of the associated vulnerabilities.

This application is a Continuation application of co-pending U.S. patentapplication Ser. No. 13/768,645 filed on Feb. 15, 2013, incorporatedherein by reference in its entirety.

BACKGROUND

1. Technical Field

The present invention relates to security analysis and, moreparticularly, to automatic correction and enhancement ofuser-implemented security downgraders.

2. Description of the Related Art

Static security analysis typically takes the form of taint analysis,where the analysis is parameterized by a set of security rules, eachrule being a triple <Src,San,Snk>, where Src denotes source statementsthat read untrusted user inputs, San denotes downgrader statements thatendorse untrusted data by validating and/or sanitizing it, and Snkdenotes sink statements which perform security-sensitive operations.Given a security rule R, any flow from a source in Src_(R) to a sink inSnk_(R) that doesn't pass through a downgrader from San_(R) comprises apotential vulnerability. This reduces security analysis to a graphreachability problem.

Traditionally, the goal of security analysis has been to detectpotential vulnerabilities in software applications (mostly webapplications) and to inform the user of these problems. The user wouldthen apply a fix, typically by introducing a downgrader (such as asanitizer or validator function) into the flow of the computation. Forexample, if an analysis tool were to discover that an application isable to read user-provided data (e.g., an HTTP parameter) and then usethis data in a security-critical operation (e.g., writing it to adatabase or to a log file), then one of the flows extending betweenthese two endpoints would be reported to the user. Such a flow is asecurity risk, as it potentially allows users to corrupt or subvert thesecurity-critical operation.

To remedy the problem, the user would install one or more securitychecks covering all flows between the endpoints to ensure that datareaching the security-sensitive operation is benign by, e.g.,transforming it through sanitization, or to reject the data throughvalidation. This solution is limited, however, in that the tool assumes,rather than verifies, that the security checks inserted by the user arecorrect. Implementing and using downgraders correctly is highlynontrivial, and users are prone to making errors. In particular, thereare many end-cases to account for, the correctness of a check oftendepends on the deployment configuration of the software system (e.g.,the type of backend database), and the context where the vulnerabilityoccurs also partially determines what needs to be check. A user may erreither in tool configuration, e.g., by defining incorrect downgraders,or in the remediation of reported vulnerabilities.

SUMMARY

A method for automatic correction of security downgraders includesdetermining, for one or more flows having one or more candidatedowngraders, whether each candidate downgrader protects against allvulnerabilities associated with said candidate downgrader's respectiveflow. Downgraders that do not protect against all of the associatedvulnerabilities are transformed, such that the transformed downgradersdo protect against all of the associated vulnerabilities.

A system for automatic correction of security downgraders includes anenhancer module with a processor configured to determine, for one ormore flows having one or more candidate downgraders, whether each of thecandidate downgraders protects against all vulnerabilities associatedwith said candidate downgrader's respective flow, and to transformcandidate downgraders that do not protect against all of the associatedvulnerabilities such that the transformed downgraders do protect againstall of the associated vulnerabilities.

These and other features and advantages will become apparent from thefollowing detailed description of illustrative embodiments thereof,which is to be read in connection with the accompanying drawings.

BRIEF DESCRIPTION OF DRAWINGS

The disclosure will provide details in the following description ofpreferred embodiments with reference to the following figures wherein:

FIG. 1 is a block/flow diagram of a method for enhancing a downgrader inaccordance with an embodiment of the present invention;

FIG. 2 is a diagram of a downgrader correction system in accordance withan embodiment of the present invention;

FIG. 3 is an exemplary vulnerable data flow prior tocorrection/enhancement in accordance with an embodiment of the presentinvention; and

FIG. 4 is an exemplary data flow having an enhanced downgrader inaccordance with an embodiment of the present invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Embodiments of the present invention provide for the remediation ofsecurity issues in software systems by first detecting an existingdowngrader along a path between a source and a sink, and secondattempting to fix or enhance that downgrader. Developers often applychecks to user input to verify its validity but, as noted above, oftendo so incorrectly or incompletely. However, there is often at least someexisting check along a path that is available to be “boosted.”Developers further prefer to make organic changes, such that modifyingexisting checks is preferable to introducing new checks. Furthermore,introducing new downgrader code might cause problems or redundancyerrors if overlapping code already exists along the flow. For example,repeating a downgrader that performs an encoding would result in adouble-encoding, which could corrupt the input. As such, embodiments ofthe present invention use instances of existing downgrader code andenhance it.

Referring now to the drawings in which like numerals represent the sameor similar elements and initially to FIG. 1, a method for automaticcorrection of security downgraders is shown. Block 102 performs asecurity analysis, disregarding any pre-existing, user-provideddowngraders in the tool configuration. For each witness flow W of typeT, block 104 finds candidate downgraders along the flow W. A witnessflow W is a representative vulnerable flow (e.g., a shortest flow). Aflow “type” refers to a class of potential security vulnerabilities. Forexample, some flows will be vulnerable to cross-site scripting (XSS)attacks, others will be vulnerable to structured query language (SQL)injection (SQLi) attacks, etc. A single flow may be vulnerable tomultiple types of attack and so may have multiple types. The followingshows an example of vulnerable flows:

String name = request.getParameter(“name”); // Source String nameEntry =“entry:” + name; response.getWriter( ).println(nameEntry); // XSS sinkStatement.execute(makeSql(nameEntry)); // SQLi sink

This shows two vulnerable flows. The first is from the source to thefirst sink, and is of type XSS, and the second is to the second sink,and is of type SQLi. In both cases, untrusted information coming fromthe user (the source) flows into a security-sensitive operation (thesink), without first being sanitized/validated. This makes it possiblefor a user to provide an input to either of the sinks that may disruptfunctionality or lead to an elevation of the user's rights in thesystem.

Detecting candidate downgraders in block 104 can be performed in severalways. One way is to apply the analysis of a security tool wheresyntactic properties of called methods are used to highlight candidatedowngraders. Another heuristic is to utilize the ignored parts of theuser configuration, which indicate the methods that the user considersto act as downgraders. Additional techniques for finding downgraders mayinclude searching for data-flow bottlenecks and by scanning userconfiguration files.

For each candidate downgrader found, block 106 checks whether thedowngrader protects all attack types corresponding to the flows that thedowngrader participates in. This may be accomplished by providing a setof test inputs to the candidate downgrader. Block 106 generates a listof vulnerabilities that the candidate downgrader fails to protect again.Block 108 then considers whether each of the checked candidatedowngraders are fully protected.

If block 108 determines that a given downgrader fully protects a flow W(i.e., if block 106 determines that the downgrader provides a correctlysanitized/validated output for every test input), the flow W is removedfrom the list at block 110. Otherwise, block 112 transforms thedowngrader to make it sufficient to prevent attacks of the relevanttypes. One possibility for augmenting the logic of an incompletedowngrader is to equip the analysis tool with a set of security checksthat, together, form a correct downgrader. When an incomplete downgraderis detected, the analysis tool attempts to add to it individual missingchecks. After each conjunction, an analysis tool can determine whetherthe result is a correct downgrader. If not, then the process continuesand additional checks are added. This process is guaranteed to terminatewith a correct downgrader, because the checks are designed such that theconjunction of all the individual checks is a correct downgrader.

Adding checks to a downgrader may be performed directly, if access tothe downgrader code is available. In some cases, however, securityanalysis may be performed on flows that use precompiled libraries orexecutables, where a downgrader may be opaque to the user. In such acase, a downgrader may be injected into the existing downgrader binarycode. Alternatively, a downgrader may be enhanced by adding checks tothe downgrader's flow output, essentially concatenating the enhancingchecks with the existing downgrader.

Block 112, as described above, “transforms” a downgrader bysupplementing it with additional validators and/or sanitizers. A givenflow may be vulnerable to a wide variety of attack types, and each suchattack type should be accounted for. In the example of astring-processing flow, where user inputs are passed to asecurity-critical resource, each potential sanitizer/validator maysimply be concatenated, as each step will simply produce asanitized/validated string for the next step. In the case of avalidator, where an input that fails is simply rejected, concatenationof individual validators is intuitive regardless of flow type.

Block 114 outputs to the user all of the flows where no candidatedowngrader was found at all, allowing the user to institute anappropriate downgrader for the flow, while block 116 reports all of thedowngrader transformations that were performed in block 112. In thisway, the user is made aware of all substantive changes to the program,and is furthermore shown the places where the security of the programcould be further improved. In an alternative embodiment, block 112 mayintroduce new downgraders in vulnerable flows that have no downgrader atall. In such an embodiment, block 116 also provides informationregarding new downgraders that were added.

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, method or computer programproduct. Accordingly, aspects of the present invention may take the formof an entirely hardware embodiment or an embodiment combining softwareand hardware aspects that may all generally be referred to herein as a“circuit,” “module” or “system.” Furthermore, aspects of the presentinvention may take the form of a computer program product embodied inone or more computer readable medium(s) having computer readable programcode embodied thereon.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readablestorage medium may be, for example, but not limited to, an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,apparatus, or device, or any suitable combination of the foregoing. Morespecific examples (a non-exhaustive list) of the computer readablestorage medium would include the following: an electrical connectionhaving one or more wires, a portable computer diskette, a hard disk, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), an optical fiber,a portable compact disc read-only memory (CD-ROM), an optical storagedevice, a magnetic storage device, or any suitable combination of theforegoing. In the context of this document, a computer readable storagemedium may be any tangible medium that can contain, or store a programfor use by or in connection with an instruction execution system,apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing. Computer program code for carrying out operations foraspects of the present invention may be written in any combination ofone or more programming languages, including an object orientedprogramming language such as Java, Smalltalk, C++ or the like andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The program codemay execute entirely on the user's computer, partly on the user'scomputer, as a stand-alone software package, partly on the user'scomputer and partly on a remote computer or entirely on the remotecomputer or server. In the latter scenario, the remote computer may beconnected to the user's computer through any type of network, includinga local area network (LAN) or a wide area network (WAN), or theconnection may be made to an external computer (for example, through theInternet using an Internet Service Provider).

Aspects of the present invention are described below with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks. The computer program instructions may also beloaded onto a computer, other programmable data processing apparatus, orother devices to cause a series of operational steps to be performed onthe computer, other programmable apparatus or other devices to produce acomputer implemented process such that the instructions which execute onthe computer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblocks may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

Reference in the specification to “one embodiment” or “an embodiment” ofthe present invention, as well as other variations thereof, means that aparticular feature, structure, characteristic, and so forth described inconnection with the embodiment is included in at least one embodiment ofthe present invention. Thus, the appearances of the phrase “in oneembodiment” or “in an embodiment”, as well any other variations,appearing in various places throughout the specification are notnecessarily all referring to the same embodiment.

It is to be appreciated that the use of any of the following “/”,“and/or”, and “at least one of”, for example, in the cases of “A/B”, “Aand/or B” and “at least one of A and B”, is intended to encompass theselection of the first listed option (A) only, or the selection of thesecond listed option (B) only, or the selection of both options (A andB). As a further example, in the cases of “A, B, and/or C” and “at leastone of A, B, and C”, such phrasing is intended to encompass theselection of the first listed option (A) only, or the selection of thesecond listed option (B) only, or the selection of the third listedoption (C) only, or the selection of the first and the second listedoptions (A and B) only, or the selection of the first and third listedoptions (A and C) only, or the selection of the second and third listedoptions (B and C) only, or the selection of all three options (A and Band C). This may be extended, as readily apparent by one of ordinaryskill in this and related arts, for as many items listed.

Referring now to FIG. 2, a downgrader correction system 200 is shown.The downgrader correction system 200 includes a processor 202 and memory204. A security analysis module 206 uses processor 202 to perform asecurity analysis on a program stored in memory 204. An enhancer module208 reviews the analysis provided by security analysis module 206 tolocate candidate downgraders in the program's flows and determineswhether any of those downgraders fail to provide for all of thepotential vulnerabilities in the flows. For each downgrader thatprovides insufficient protection, the enhancer module 208 addsadditional checks until the downgrader is able to fully protect theflow. The report module 210 then generates a report to the user thatincludes, e.g., a description of all vulnerable flows that lack adowngrader and a description of all enhancements made to the existingdowngraders.

Referring now to FIG. 3, an exemplary data flow is shown. At block 302 auser provides some input. For example, the user desires to perform asearch and enters the search terms as a string. Block 304 receives theinput and performs some elementary validation. For example, block 304may check to determine whether the string is a null string and whetherit has the correct format for a search query. If the input fails thesetests, then block 304 may reject the query and provide an error message.If the downgrader concludes that the string meets its requirements, thenthe string is passed to database 306 and executed.

However, in the present example, the downgrader 304 is incomplete anddoes not protect against potential attacks. As an example, consider anincomplete downgrader 304 that fails to sanitize user inputs to protectagainst SQL injection attacks. Such an attack allows the malicious userto provide direct commands to database 306, allowing the user to haveaccess to sensitive information, such as credit cards and passwords. Ifthe downgrader 304 does not provide, for example, filtering of escapecharacters or strong typing of the input 302, then there is nothing toprevent such attacks.

Referring now to FIG. 4, the exemplary flow described above is shownagain, after having had its downgrader 304 enhanced according to anembodiment of the present invention. Rather than replacing theincomplete downgrader 304, individual sanitization/validationdowngraders 402 are placed in the data flow. For example, eachadditional downgrader 402 may check for a particular control or escapecharacter or sequence which should be removed from the input. Theadditional downgraders 402 may simply be added into the flow after theincomplete downgrader 304, performing whatever additional processing isneeded to fully protect the flow from any detected vulnerabilities. Anynumber of additional downgraders 402 may be added in this way.

Having described preferred embodiments of a system and method forautomatic correction of security downgraders (which are intended to beillustrative and not limiting), it is noted that modifications andvariations can be made by persons skilled in the art in light of theabove teachings. It is therefore to be understood that changes may bemade in the particular embodiments disclosed which are within the scopeof the invention as outlined by the appended claims. Having thusdescribed aspects of the invention, with the details and particularityrequired by the patent laws, what is claimed and desired protected byLetters Patent is set forth in the appended claims.

What is claimed is:
 1. A method for automatic correction of securitydowngraders, comprising: determining, for one or more flows having oneor more candidate downgraders, whether each candidate downgraderprotects against all vulnerabilities associated with said candidatedowngrader's respective flow; and transforming with a processorcandidate downgraders that do not protect against all of the associatedvulnerabilities, such that the transformed downgraders do protectagainst all of the associated vulnerabilities.
 2. The method of claim 1,wherein transforming candidate downgraders comprises adding a validatingor sanitizing step to the candidate downgraders that checks for a knownvulnerability.
 3. The method of claim 2, wherein transforming candidatedowngraders comprises concatenating the added validating or sanitizingstep with an existing candidate downgrader in a respective flow.
 4. Themethod of claim 2, wherein transforming candidate downgraders comprisesinjecting a validating or sanitizing step into an existing precompiledcandidate downgrader in a respective flow.
 5. The method of claim 2,further comprising repeating said steps of determining and transforminguntil each candidate downgrader has been enhanced to address all knownvulnerabilities associated with candidate downgrader's respective flow.6. The method of claim 1, further comprising generating a report thatincludes information regarding flows that have no downgrader and a listof transformations made to the candidate downgraders.
 7. The method ofclaim 1, wherein determining whether each of the candidate downgradersprotects against all vulnerabilities comprises providing a set of testinputs to each of the candidate downgraders to determine whether saidcandidate downgraders correctly downgrade the input.
 8. The method ofclaim 7, further comprising generating a set of test inputs for eachvulnerable flow that includes at least one test input that exploits eachvulnerability associated with the vulnerable flow.
 9. The method ofclaim 1, further comprising adding a complete downgrader to any eachflow that has no downgrader.
 10. A computer readable storage mediumcomprising a computer readable program for automatic correction ofsecurity downgraders, wherein the computer readable program whenexecuted on a computer causes the computer to perform the steps of:determining, for one or more flows having one or more candidatedowngraders, whether each candidate downgrader protects against allvulnerabilities associated with said candidate downgrader's respectiveflow; and transforming candidate downgraders that do not protect againstall of the associated vulnerabilities, such that the transformeddowngraders do protect against all of the associated vulnerabilities.11. A system for automatic correction of security downgraders,comprising: an enhancer module comprising a processor configured todetermine, for one or more flows having one or more candidatedowngraders, whether each of the candidate downgraders protects againstall vulnerabilities associated with said candidate downgrader'srespective flow, and to transform candidate downgraders that do notprotect against all of the associated vulnerabilities such that thetransformed downgraders do protect against all of the associatedvulnerabilities.
 12. The system of claim 11, wherein the enhancer moduleis further configured to add a validating or sanitizing step to thecandidate downgraders that checks for a known vulnerability.
 13. Thesystem of claim 12, wherein the enhancer module is further configured toconcatenate the added validating or sanitizing step with an existingcandidate downgrader in a respective flow.
 14. The system of claim 12,wherein the enhancer module is further configured to inject the addedvalidating or sanitizing step into an existing precompiled candidatedowngrader in a respective flow.
 15. The system of claim 12, wherein theenhancer module is further configured to repeat the determination andtransformation until each candidate downgrader has been enhanced toaddress all known vulnerabilities associated with candidate downgrader'srespective flow.
 16. The system of claim 11, further comprising a reportmodule configured to generate a report that includes informationregarding flows that have no downgrader and a list of transformationsmade to the candidate downgraders.
 17. The system of claim 11, whereinthe enhancer module is further configured to provide a set of testinputs to each of the candidate downgraders to determine whether saidcandidate downgraders correctly downgrade the input.
 18. The system ofclaim 17, wherein the enhancer module is further configured to generatea set of test inputs for each vulnerable flow that includes at least onetest input that exploits each vulnerability associated with thevulnerable flow.
 19. The system of claim 11, wherein the enhancer moduleis further configured to add a complete downgrader to any each flow thathas no downgrader.